Providing software solutions since 1976

• Log in
• Create profile
• Welcome
  [Log out]
• Edit profile

• Print  |
• Feedback  |
• Share

  • E-mail

  
  
  

  E-mail This Page

  Your Name:*
  Your E-mail:*
  Recipient E-mail:*
  Send a copy to me
  Personal Message:
  
  

  * indicates a required field

The Stored Process Server authenticates client users through host authentication. So, if you use an alternative authentication provider, such as LDAP or Microsoft Active Directory, each client user must also have a host account for the SAS Stored Process Server machine or be a member of a metadata group that has a valid host account login. Authentication domains are used to determine which login account will be used by the SAS Stored Process Server for single-signon security.

Consider the following example:

1. A user named Bob Smith has an LDAP account called bobsmith@abc.
2. Bob Smith does not have a valid host account on the SAS Stored Process Server machine. So, you must create a metadata group that has a login account that is a valid host account on the SAS Stored Process Server machine. Bob must be a member of this group.
3. For example, the group might be called STPUSERS and the host login account might be stpuser1.
4. The stpuser1 user account (the login account for STPUSERS) must be in the same Authentication Domain as the SAS Stored Process Server. For example:

        Authentication Domain: DefaultAuth       
        User ID:               stpuser1
   
   

In this example, the SAS Stored Process Server is also in the DefaultAuth Authentication Domain.
5. The LDAP account must be in a Authentication Domain that is different than the Authentication Domain that is associated with the SAS Stored Process Server. For example:

        Authentication Domain: LDAPAuth       
        User ID:               bobsmith@abc
   

Here is a summary of the sequence of events that occurs when Bob Smith logs on to the client and executes a stored process.

1. Bob logs on to the client application (for example, SAS^® Enterprise Guide^®) using his LDAP user account bobsmith@abc.
2. Bob executes a stored process.
3. The client (SAS Enterprise Guide) accesses the SAS^® Metadata Server and requests a user login account for Bob Smith that is associated with the SAS Stored Process Server's Authentication Domain (DefaultAuth).

   Bob Smith is a member of the STPUSERS group that has a login account called stpuser1 that is associated with DefaultAuth. So, stpuser1 is the user account that is passed by the client (SAS Enterprise Guide) to the SAS Stored Process Server for user authentication.

4. The SAS Stored Process Server successfully authenticates the user using the stpuser1 account. Then, the SAS Stored Process Server executes the request.

Note: If Bob Smith is a member of multiple metadata groups and each group has a login account for DefaultAuth, then one of the login accounts will be used for the SAS Stored Process Server request (but, it is not possible to predict which login account will be used).

Operating System and Release Information